Using JWT As authentication Protocol in Named Credentials for External Service

Question

As a part of my project work, I need to connect to Azure Logic App via External Service in Salesforce. I know the prerequisite is to create Named Credentials first.

I have chosen following in setting up Named Credentials

Identity Type: Named Principal Authentication Protocol: JWT

Certificate: Here I am confused whether it should be Salesforce Generated Certificate or Azure Generated?? Issuer: What value needs to be put here? SF Documentation says Specify who issued the JWT using a case-sensitive string I really don't get it. Named Principal Subject?? Audiences:??

I could not find good example where Named Credentials with JWT gets used to call Azure. Any help will be appreciated.

Answer 1

1. Certificate

The certificate should be generated on Azure and imported into Salesforce.

One consideration is Salesforce only accepts certificates in the .jks format. You will import using the certificate and key management. Check the screenshot below

If you have this in any other format you will need to translate it to .jks format using open SSL.

2. Issuer: What value needs to be put here?

This is provided again by Azure services. Any JWT system that accepts JWT requests provides an Issuer value. It's generally a string value.

For example if you were connecting to Salesforce from another system, this will be clientId of the connected app.

3. Named Principal Subject

This is also provided by Azure services. Usually, this is a username or a unique identity

For example if you were connecting to Salesforce from a third party system this is username of the user you are using to connect to Salesforce.

4. Audiences

This is usually the url shared by the service. Azure external service if this supports JWT then this will be documented.

For example if you were connecting to Salesforce from a third party system this will be https://login.salesforce.com